ethernet
84874c58a5
allow you to simulate the whole official curl | bash installer,
and subsequent hermes updates.
Run development commands in a bubblewrap filesystem and network sandbox
with a local HTTPS MITM fixture server and a fake github
git-upload-pack transport.
Package the sandbox command and expose it from the nix devShell.
Stage the local installer at its canonical fake HTTPS URL and add a
persistent installation/update test path. Route root installs through
sandbox-owned filesystem locations and snapshot dirty source worktrees
into temporary fake commits so update tests can fast-forward without
changing the real checkout.
Includes a --install-ref sandbox installer mode that fetches any commit
(--from-main is a nice shorthand for local development) outside the
sealed sandbox, installs from that snapshot, and then promotes the fake
remote to the current worktree so update flows can be exercised with FF.
Notes on non-root sandboxes:
Giving a non-root sandbox a network is tricky.
slirp4netns joins the target userns and setuids to root before configuring the
netns, so the userns must map a uid 0; bwrap's --unshare-user maps exactly ONE
uid, so --uid 1000 leaves no root to become and slirp diedswith
`setns(CLONE_NEWNET): Operation not permitted`. Stage 1 builds the user+net
namespaces with `unshare` and two one-id ranges:
inner 0 -> a subuid, unused by the payload, present only so slirp can
become root
inner 1000 -> our real host uid
Mapping the payload to the *host* uid (not a second subuid) keeps everything the
sandbox writes owned by us, so `rm -rf` on a persistent sandbox still needs no
privileges. Stage 2 execs bwrap WITHOUT --unshare-user -- it only adds mount/pid
-- sidestepping bwrap's refusal to accept --uid outside a userns it created.
Costs a /etc/subuid range for the invoking user (we error with the exact line to
add) and util-linux `unshare`; `--root` needs neither.
125 lines
1.8 KiB
Nix
125 lines
1.8 KiB
Nix
{
|
|
# electron deps
|
|
alsa-lib,
|
|
at-spi2-atk,
|
|
atk,
|
|
cairo,
|
|
cups,
|
|
dbus,
|
|
expat,
|
|
fontconfig,
|
|
freetype,
|
|
glib,
|
|
gtk3,
|
|
libdrm,
|
|
libgbm,
|
|
libxkbcommon,
|
|
mesa,
|
|
nspr,
|
|
nss,
|
|
pango,
|
|
systemd,
|
|
libX11,
|
|
libXcomposite,
|
|
libXdamage,
|
|
libXext,
|
|
libXfixes,
|
|
libXrandr,
|
|
libXrender,
|
|
libXtst,
|
|
libxcb,
|
|
|
|
# sandbox deps
|
|
bash,
|
|
bubblewrap,
|
|
cacert,
|
|
coreutils,
|
|
curl,
|
|
gawk,
|
|
git,
|
|
glibc,
|
|
gnumake,
|
|
gnugrep,
|
|
gnused,
|
|
gzip,
|
|
nodejs_22,
|
|
openssl,
|
|
python3,
|
|
slirp4netns,
|
|
stdenv,
|
|
gnutar,
|
|
util-linux,
|
|
|
|
# etc
|
|
writeShellApplication,
|
|
lib,
|
|
}:
|
|
let
|
|
electronRuntime = [
|
|
alsa-lib
|
|
at-spi2-atk
|
|
atk
|
|
cairo
|
|
cups
|
|
dbus
|
|
expat
|
|
fontconfig
|
|
freetype
|
|
glib
|
|
gtk3
|
|
libdrm
|
|
libgbm
|
|
libxkbcommon
|
|
mesa
|
|
nspr
|
|
nss
|
|
pango
|
|
systemd
|
|
libX11
|
|
libXcomposite
|
|
libXdamage
|
|
libXext
|
|
libXfixes
|
|
libXrandr
|
|
libXrender
|
|
libXtst
|
|
libxcb
|
|
];
|
|
in
|
|
writeShellApplication {
|
|
name = "sandbox";
|
|
runtimeInputs = [
|
|
bash
|
|
bubblewrap
|
|
cacert
|
|
coreutils
|
|
curl
|
|
gawk
|
|
git
|
|
glibc.bin
|
|
gnumake
|
|
gnugrep
|
|
gnused
|
|
gzip
|
|
nodejs_22
|
|
openssl
|
|
python3
|
|
slirp4netns
|
|
stdenv.cc
|
|
gnutar
|
|
util-linux
|
|
]
|
|
++ electronRuntime;
|
|
text = ''
|
|
export DEV_SANDBOX_REAL_CA_CERT=${cacert}/etc/ssl/certs/ca-bundle.crt
|
|
export DEV_SANDBOX_DYNAMIC_LINKER=${stdenv.cc.bintools.dynamicLinker}
|
|
export DEV_SANDBOX_NODE_DIR=${nodejs_22}
|
|
export DEV_SANDBOX_ELECTRON_LD_LIBRARY_PATH=${lib.makeLibraryPath electronRuntime}
|
|
# The script is imported into the store as a single file, so its own
|
|
# directory has no scripts/sandbox/ beside it. Point it at the assets
|
|
# (fake-internet proxy, ssh shim) explicitly.
|
|
export DEV_SANDBOX_ASSETS=${../scripts/sandbox}
|
|
exec ${../scripts/dev-sandbox.sh} "$@"
|
|
'';
|
|
}
|